Before a Marketing Agent Uses MCP, Draw the Blast Radius

“The agent can read campaign data, check the CRM, research competitors, and update ads” sounds efficient because the sentence hides four trust zones. Each connector introduces credentials, data exposure, tool descriptions, returned content, and possible side effects. The protocol makes those interactions easier to describe; the host still has to decide what is allowed.

The MCP specification emphasizes user consent, data privacy, tool safety, and access control. Current security guidance from the NSA similarly warns that MCP adoption in sensitive workflows requires careful implementation. Start by assuming that any external content the agent reads can be adversarial and any write-capable tool can create a costly side effect.

List every actor, credential, server, tool, resource, destination, and log. Mark where untrusted content enters and where data can leave. Then ask what happens if a retrieved page tells the model to ignore the user, if a tool description is changed, if a server is impersonated, or if two harmless permissions combine into a sensitive export.

A system instruction that says “never leak data” is useful behavior guidance, not an authorization boundary. Enforce permissions in the host and downstream APIs. Separate read tools from write tools. Require a structured proposal before a material action, validate the proposal against policy, and obtain approval that names the account, object, change, and expected consequence.

For repetitive low-risk actions, approval can be pre-authorized within explicit limits. The limit still belongs in code or policy: daily spend delta, allowed fields, approved destinations, maximum batch size, and a clear expiration.

Build evaluations containing malicious pages, poisoned tool metadata, oversized exports, lookalike destinations, stale credentials, replayed approvals, and partial failures. Confirm that logs identify the initiator, data accessed, proposed call, policy result, approval, response, and compensating action without storing sensitive prompt contents unnecessarily.

No control eliminates prompt injection completely. OpenAI describes it as an evolving security challenge and recommends layered defenses. The honest launch criterion is therefore not “the agent is safe.” It is that the useful workflow has a bounded blast radius, observable failures, and a practiced way to stop it.